Anthropic API Key Format (sk-ant-api03)

Every Anthropic API key starts with sk-ant-api03-. This is a quick breakdown of what each piece means, how to spot a valid key, and the difference between the two token types Anthropic issues (api03 vs oat01).

Anatomy of a key

Total length is about 108 characters. The body is URL-safe so the key can travel in headers and querystrings without escaping, but you should still treat it as a secret and pass it via the x-api-key header, not a URL parameter.

api03 vs oat01 — two token types

Anthropic actually issues two kinds of Bearer tokens. Both work against api.anthropic.com, but they bill different surfaces:

• sk-ant-api03-… — an API key from console.anthropic.com. Bills your Anthropic API account per token used. This is the path for production apps.
• sk-ant-oat01-… — an OAuth access token issued by the Claude CLI's claude setup-token command, tied to a Claude Pro or Max subscription. Bills against that subscription's quota — no per-token charge. Same interface; different billing.

Most third-party hosted-agent platforms only accept the api03 path. Tools that integrate deeply with Claude — Claude Code itself, VibeKit, a few others — also accept oat01 so Pro/Max subscribers can use what they're already paying for.

How to generate one

# For an API key (sk-ant-api03-…):
1. Sign in to console.anthropic.com
2. Settings → API Keys → "Create Key"
3. Name it after the tool you'll use it in (so you can revoke per-tool later)
4. Copy the key once — Anthropic does not show it again
5. Fund the account if it's new — $5+ in credit unlocks production traffic

# For a subscription token (sk-ant-oat01-…):
1. Install Claude CLI: npm i -g @anthropic-ai/claude-code
2. Run: claude setup-token
3. Open the URL it prints, log in to Claude Pro / Max
4. Paste the returned token back into the CLI
5. The token lasts about a year before re-auth is required

Validating a key locally

You can pattern-match the prefix in code without a network call:

function isAnthropicKey(s) {
  return /^sk-ant-(api03|oat01)-[A-Za-z0-9_-]{40,}$/.test(s);
}

To confirm it's actually live and has credit, hit a tiny /messages request:

curl -s https://api.anthropic.com/v1/messages \
  -H "x-api-key: $KEY" \
  -H "anthropic-version: 2023-06-01" \
  -H "content-type: application/json" \
  -d '{"model":"claude-sonnet-4-6","max_tokens":4,"messages":[{"role":"user","content":"hi"}]}'

A 200 with a small completion confirms the key works. A 401 means revoked or typoed. A 402 means out of credit. A 429 means rate-limited (still a valid key).

Using a key with a hosted AI agent

If you're trying to plug an Anthropic key into an agent so you can build apps without writing infrastructure code, VibeKit is BYOK-first: paste your sk-ant-api03- (or sk-ant-oat01-) into Profile → AI Provider → Anthropic, and the agent's next request runs through your Anthropic account. Charges go straight to Anthropic; VibeKit doesn't bill on top. Free tier is genuinely free with BYOK — no per-session markup, no token clipping.

Security hygiene

• One key per third-party tool. Easier to revoke a specific integration if something goes wrong.
• Watch per-key usage on the console. Sudden spikes are the first signal of a leaked or misconfigured key.
• Encrypt at rest, in memory only at request time. Any host that asks for the plaintext to be stored anywhere persistent isn't doing it right.
• Rotate when team members leave. Compromised keys are most often the result of internal-system exposure, not external attack.

FAQ